基于UEBA的用户网络异常行为孤立森林与监督学习对比分析

Comparative Analysis of Isolated Forest and Supervised Learning for User Network Abnormal Behavior Based on UEBA

随着企业信息化水平的提升,内部用户成为敏感数据安全事件发生的主要因素.针对监督学习分析网络异常行为工作量大成本高问题,采用孤独森林算法快速地进行异常点检测,且能实现比监督学习更精准有效.

With the improvement of enterprise informatization,internal users have become the main factor in the occurrence of sensitive data security incidents.In order to solve the problem of heavy workload and high cost in using supervised learning to analyze the user network abnormal behavior,the isolated forest algorithm is used to quickly identify and detect abnormal points and can function more accurately and effectively than supervised learning.